The covered entity (CE), Lawrence General Hospital, discovered that a portable computer drive (a "thumb" drive), which was not encrypted or password-protected, was missing following a theft in the laboratory. The protected health information involved included names, laboratory testing codes, and slide identification numbers, affecting 2,071 individuals. The CE provided breach notification to HHS, affected individuals, and the media. Following the breach, the CE eliminated the need to use a thumb drive in the pathology laboratory and accelerated the completion of reconfiguring all compatible computer ports ("USB" ports) to disable the use of unencrypted thumb drives. The CE also implemented new procedures to monitor the receipt of media and devices. OCR obtained assurances that the CE implemented the corrective actions listed above.
